The last time there was such a scandal in online poker, it nearly killed the game.
In the early 2000s, during the poker boom, players at UltimateBet were scammed by someone with backdoor access to a customer. Superuser, in other words: an account that can see every opponent’s hole cards in real time. Eventually, he was identified as former WSOP Main Event champion Russ Hamilton, and the numbers he took from players exceeded $20 million. Poker grew so fast that it somehow recovered and continued to climb.
This week’s version is in a different form and somehow worse. It’s a hammer blow to an already fragile industry on the brink.
The accused is Paul Gregg, a Canadian who played medium or high stakes on Winning Poker Network sites including GGPoker, CoinPoker and ACR. He has not responded publicly and has not faced any charges.
Here’s what happened, according to investigators: Two third-party poker tools, Jurojin and IntuitiveTables, switched software updates, and both have now confirmed the compromise. The attacker modified the Mesh Agent, a component of a legitimate open-source IT software called MeshCentral, so no antivirus detected it. On an infected machine, it gave a live view of the screen, control of the mouse and keyboard, and every hole card on it.
It is normal for grinders to use these tools. I used Jurojin myself for table management and additional betting buttons. Between March 2024 and June 2026, around 30 high-stakes players were reportedly hit.
UltimateBet was an inside job and the industry could tell it was dealing with a rogue operator. It came via software that thousands of players voluntarily installed and no one checked.
JackKlompus, one of Gregg’s accounts, won $402,700 from 32,200 hands on WPN at a ratio of 24 big blinds per 100 hands. Its regular game was $25/$50 where you play some of the best players live. A true elite winner at this level can win anywhere from one to three. Five would be significant. He averaged over 42 in the biggest games he played.
Then there’s a 140-hand stretch at $0.25/$0.50, a stake he otherwise never touched, losing $374.70. That’s about seven and a half full buyouts in 140 hands. You can’t lose money that quickly by accident. Players who reviewed the data said that he was deliberately throwing in small stakes to drag his overall win rate down to something that looked very good instead of impossible.
Here’s the part that bothers everyone who plays online. This is not news for everyone. CoinPoker caught it two years ago.
Their security team flagged an account playing as “Europe”, banned it and confiscated over $100,000 and redistributed it to the players it beat. Gregg filed a complaint with the gaming regulator, demanding a refund and protesting his innocence. CoinPoker has built its case and prepared for the hearing. He refused the claim. The ban stopped.
That was two years ago. He continued to play everywhere.
GGPoker and ACR had every hand they played sitting on their servers. Patrick Howard, who coaches as Mobius Poker, says he analyzed 32,780 hands after a friend’s unexplained losses and sent GGPoker a report showing the patterns. He says nothing came out.
Spanish high roller Nacho Morón, who lost $60,000 to Europe in fifteen minutes, bringing his total losses to $200,000, says the accounts were reported “more than 20 or 30 times” in the two years he was active. “I give all the responsibility to the rooms,” he said. “It’s been a long time.”
Then the hardest line from a man cleared by him: “The newest room at the time was CoinPoker, and the least developed and the first room to catch it.”
Poker grew out of UltimateBet. There was so much new money coming in that the industry could absorb the $20 million theft and continue to rise.
That money is not coming now. The games are smaller, the players are sharper, and the one thing that still holds it all together is the belief that someone above is checking. There was no one for two years.